修改php执行文件,用GDB修改可执行文件的代码和变量

下面我向大家介绍一下使用gdb修改可执行文件中的代码和变量的方法。

另，在GDB文档中介绍这个方法也 能修改CORE文件的内容，本人未验证。

在 一般情况下GDB是以只读方式打开可执行文件的，如果需要改变可执行文件，需要在读入文件以前，用GDB启动参数“–write”或者命令“set write on”用可读写方式打开可执行文件。如果文件已经打开了可执行文件，就需要使用exec-file重新以读写方式打开可执行文件，注意如果你还没打开可执行文件，就一定要使用file命令读入，因为exec-file不会重新读入符号信息。

还有要注意的是，因为修改只能修改section的内容，所以能修改的变量只能是非0的全局变量，内容是O的变量会被放入bss。

1.c:

#include

int a = 1;

int

main(int argc,char *argv[],char *envp[])

{

printf ("%d\n", a);

return 0;

}

1

2

3

4

5

6

7

8

#include

inta=1;

int

main(intargc,char*argv[],char*envp[])

{

printf("%d\n",a);

return0;

}

gcc -g 1.c

./a.out

1

#gdb

GNU gdb 6.8-debian

Copyright (C) 2008 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law. Type "show copying"

and "show warranty" for details.

This GDB was configured as "x86_64-linux-gnu".

(gdb) set write on ＃打开功能

(gdb) file ./a.out ＃打开文件

Reading symbols from /home/teawater/gdb/a.out...done.

(gdb) p a = 100 #修改变量的文件中的值

$1 = 100

1

2

3

4

5

6

7

8

9

10

11

12

13

#gdb

GNUgdb6.8-debian

Copyright(C)2008FreeSoftwareFoundation,Inc.

LicenseGPLv3+:GNUGPLversion3orlater

Thisisfreesoftware:youarefreetochangeandredistributeit.

ThereisNOWARRANTY,totheextentpermittedbylaw.Type"show copying"

and"show warranty"fordetails.

ThisGDBwasconfiguredas"x86_64-linux-gnu".

(gdb)setwriteon＃打开功能

(gdb)file./a.out＃打开文件

Readingsymbolsfrom/home/teawater/gdb/a.out...done.

(gdb)pa=100#修改变量的文件中的值

$1=100

./a.out

100

下面举例修改代码内容：

1.c:

#include

void

cool (void)

{

printf ("Call function cool.\n");

}

int

main(int argc,char *argv[],char *envp[])

{

cool ();

return 0;

}

1

2

3

4

5

6

7

8

9

10

11

12

#include

void

cool(void)

{

printf("Call function cool.\n");

}

int

main(intargc,char*argv[],char*envp[])

{

cool();

return0;

}

#gcc -g 1.c

#./a.out

Call function cool.

1

Callfunctioncool.

修改代码内容：

gdb --write ./a.out #使用--write直接打开可写功能

GNU gdb 6.8-debian

Copyright (C) 2008 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law. Type "show copying"

and "show warranty" for details.

This GDB was configured as "x86_64-linux-gnu"...

(gdb) disas cool

Dump of assembler code for function cool:

0x000000000040050c : push %rbp #注意改之前这条指令

0x000000000040050d : mov %rsp,%rbp

0x0000000000400510 : mov $0x40062c,%edi

0x0000000000400515 : callq 0x4003f8

0x000000000040051a : leaveq

0x000000000040051b : retq

End of assembler dump.

(gdb) set *(unsigned char *)(0x000000000040050c) = 0xc3 #修改指令

(gdb) disas cool

Dump of assembler code for function cool:

0x000000000040050c : retq #改之后这指令发生了变化

0x000000000040050d : mov %rsp,%rbp

0x0000000000400510 : mov $0x40062c,%edi

0x0000000000400515 : callq 0x4003f8

0x000000000040051a : leaveq

0x000000000040051b : retq

End of assembler dump.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

gdb--write./a.out#使用--write直接打开可写功能

GNUgdb6.8-debian

Copyright(C)2008FreeSoftwareFoundation,Inc.

LicenseGPLv3+:GNUGPLversion3orlater

Thisisfreesoftware:youarefreetochangeandredistributeit.

ThereisNOWARRANTY,totheextentpermittedbylaw.Type"show copying"

and"show warranty"fordetails.

ThisGDBwasconfiguredas"x86_64-linux-gnu"...

(gdb)disascool

Dumpofassemblercodeforfunctioncool:

0x000000000040050c:push%rbp#注意改之前这条指令

0x000000000040050d:mov%rsp,%rbp

0x0000000000400510:mov$0x40062c,%edi

0x0000000000400515:callq0x4003f8

0x000000000040051a:leaveq

0x000000000040051b:retq

Endofassemblerdump.

(gdb)set *(unsignedchar*)(0x000000000040050c)=0xc3#修改指令

(gdb)disascool

Dumpofassemblercodeforfunctioncool:

0x000000000040050c:retq#改之后这指令发生了变化

0x000000000040050d:mov%rsp,%rbp

0x0000000000400510:mov$0x40062c,%edi

0x0000000000400515:callq0x4003f8

0x000000000040051a:leaveq

0x000000000040051b:retq

Endofassemblerdump.

. /a.out                     #现在没有输出了 因为cool函数直接返回了